Security readout for executives and security teams
Plain-English summary
A flaw in the Linux Cdns3 USB gadget driver can free the same memory twice while processing an internally added zero-length packet. This may corrupt kernel memory, crash the system, or potentially compromise confidentiality and integrity. The CVSS score is 7.8, but exposure depends on the affected driver and transfer path being present and used.
Executive priority
Treat this as an urgent kernel maintenance issue on systems actively using Cdns3 USB gadget functionality. The potential impact is system-level, but the cited evidence indicates local rather than remote access and does not establish active exploitation. Systems without the relevant driver path should receive lower priority after exposure is verified.
Technical view
When a transfer length is an exact multiple of the endpoint maximum packet size, Cdns3 adds a zero-length packet request. Completion handling passed that request to usb_gadget_giveback_request(), which freed it, then freed it again after recognizing the driver's zero-length buffer. The resulting double-free manifested as a KFENCE-reported use-after-free. Stable kernel commits prevent the first giveback for this internal request.
Likely exposure
The supplied record lists affected Linux releases from 5.4 through 6.8, including specified stable versions. Practical exposure is concentrated on systems using the Cdns3 USB gadget driver and the vulnerable zero-length-packet path. Version numbers alone may be unreliable because distributors backport kernel fixes; confirm against the running vendor kernel and its advisory or changelog.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact. The bundle marks this CVE as absent from KEV, and no cited source establishes active exploitation or a public exploit. The evidence demonstrates a reproducible memory-safety failure, not confirmed weaponization.
Researcher notes
The fix distinguishes the driver's internally allocated zero-length request from ordinary completed requests. It skips usb_gadget_giveback_request() for that internal request, preventing the first free before cdns3_gadget_ep_free_request(). The bundle supplies several stable-branch commits but does not provide a complete distribution-by-distribution fixed-version matrix or evidence that the memory corruption has been converted into reliable privilege escalation.
Mitigation direction
- Install a vendor kernel containing the applicable cited stable fix.
- Reboot affected systems into the updated kernel and verify it is running.
- Prioritize systems that actively use the Cdns3 USB gadget driver.
- Consult distribution guidance because fixed code may be backported without changing the upstream version pattern.
Validation and detection
- Inventory running kernel versions on systems where Cdns3 USB gadget functionality may be used.
- Determine whether the Cdns3 gadget driver and relevant hardware path are active.
- Verify the running kernel contains the corresponding stable fix or documented vendor backport.
- Review kernel logs for Cdns3 use-after-free or KFENCE signatures; their absence does not establish safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26748 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/aad6132ae6e4809e375431f8defd1521985e44e7CVE reference, Linux
- https://git.kernel.org/stable/c/1e204a8e9eb514e22a6567fb340ebb47df3f3a48CVE reference, Linux
- https://git.kernel.org/stable/c/3a2a909942b5335b7ea66366d84261b3ed5f89c8CVE reference, Linux
- https://git.kernel.org/stable/c/9a52b694b066f299d8b9800854a8503457a8b64cCVE reference, Linux
- https://git.kernel.org/stable/c/70e8038813f9d3e72df966748ebbc40efe466019CVE reference, Linux
- https://git.kernel.org/stable/c/92d20406a3d4ff3e8be667c79209dc9ed31df5b3CVE reference, Linux
- https://git.kernel.org/stable/c/5fd9e45f1ebcd57181358af28506e8a661a260b3CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.